UK ICO — Automated Decisions — the verified record, live

Automated decision-making in the UK is regulated principally through data protection law: Article 22 of UK GDPR historically restricted solely automated decisions with legal or similarly significant effects, and the Information Commissioner's Office polices how organisations deploy profiling, AI-assisted decisions and the transparency and human review safeguards that attach to them. The Data (Use and Access) Act 2025 reshaped this ground, replacing the old prohibition-based model with a more permissive regime for most personal data — allowing solely automated significant decisions subject to safeguards such as information, human intervention and contestation — while retaining stricter limits where special category data is involved. The ICO has been updating its guidance to match, within a wider programme on AI that includes its AI and biometrics strategy and scrutiny of recruitment tools, facial recognition and public sector uses. For any organisation automating consequential decisions about individuals — credit, hiring, welfare, pricing — the combination of amended statute and evolving ICO expectations makes this a regime to track rather than assume.

Every document below comes from the body that published it — regulators, courts, parliaments, official registers — with its true publication date and a link to the primary source.

as of 2026-08-31 · refreshed from scheduled releases

Latest developments

Publishing bodies represented

Frequently asked

Are solely automated decisions lawful in the UK?

Increasingly, yes, subject to safeguards. Following the Data (Use and Access) Act 2025, solely automated decisions with significant effects are generally permitted for ordinary personal data provided the organisation gives information about the decision, enables the individual to make representations, obtain human intervention and contest the outcome. Stricter, prohibition-style rules continue to apply where special category data is used.

What does the ICO expect from organisations using ADM and AI?

Compliance with data protection principles applied to the AI lifecycle: lawful basis and fairness, transparency about the logic and significance of decisions, data minimisation, accuracy, security, and meaningful human review where required. The ICO has published guidance on AI and data protection and explaining AI-assisted decisions, and has signalled priorities including recruitment tools, facial recognition and children's data.

What are the penalties for unlawful automated decision-making?

ADM breaches are enforced under UK GDPR, so the ICO can issue enforcement notices requiring changes to processing and fines of up to £17.5 million or 4% of worldwide annual turnover, whichever is higher. In practice the ICO often proceeds first through reprimands, audits and enforcement notices, but automated decisions with significant effects on individuals sit squarely within its stated priorities.

More: The Wire — this week across the record · all 38 ecosystems · analyst briefs on this regulation ↗